diff --git a/.github/workflows/preview.yaml b/.github/workflows/preview.yaml
index 001b2c4..a2a9400 100644
--- a/.github/workflows/preview.yaml
+++ b/.github/workflows/preview.yaml
@@ -156,7 +156,7 @@ jobs:
           AUTHKEY=$(curl -fsSL -X POST \
             -H "Authorization: Bearer $TOKEN" \
             -H "Content-Type: application/json" \
-            -d '{"capabilities":{"devices":{"create":{"reusable":false,"ephemeral":true,"preauthorized":true,"tags":["tag:prodzilla-preview"]}}},"expirySeconds":3600}' \
+            -d '{"capabilities":{"devices":{"create":{"reusable":true,"ephemeral":true,"preauthorized":true,"tags":["tag:prodzilla-preview"]}}},"expirySeconds":3600}' \
             https://api.tailscale.com/api/v2/tailnet/-/keys | jq -r .key)
           echo "::add-mask::$AUTHKEY"
 
diff --git a/Dockerfile b/Dockerfile
index 5b5c969..8a998dc 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -6,20 +6,41 @@ ARG RUST_VERSION=1.85
 FROM node:20-slim AS frontend-build
 WORKDIR /app/frontend
 COPY frontend/package*.json ./
-RUN npm ci
+RUN --mount=type=cache,target=/root/.npm npm ci
 COPY frontend/ ./
 RUN npm run build
 
-# Build Rust binary
-FROM rust:${RUST_VERSION}-slim-bookworm AS build
-
+# Rust build base with cargo-chef preinstalled
+FROM lukemathwalker/cargo-chef:latest-rust-${RUST_VERSION} AS chef
 WORKDIR /app
+RUN apt-get update -y \
+    && apt-get install -y --no-install-recommends libssl-dev pkg-config \
+    && rm -rf /var/lib/apt/lists/*
+
+# Generate the dependency recipe. Only Cargo.toml/Cargo.lock content
+# (via recipe.json) determines the cook cache key downstream.
+FROM chef AS planner
+COPY . .
+RUN cargo chef prepare --recipe-path recipe.json
 
-RUN apt-get update -y && apt-get install -y libssl-dev pkg-config
+# Cook deps, then build the binary. Keep target/ in the layer (so the cooked
+# deps live in a cacheable Docker layer) and use BuildKit cache mounts only
+# for cargo's registry/git, which speeds up cold-cache fetches. Pin the
+# target dir explicitly because the cargo-chef base image overrides
+# CARGO_TARGET_DIR to a project-name-derived path under /tmp.
+FROM chef AS build
+ENV CARGO_TARGET_DIR=/app/target
+COPY --from=planner /app/recipe.json recipe.json
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
+    cargo chef cook --release --recipe-path recipe.json
 
 COPY . .
 COPY --from=frontend-build /app/frontend/dist ./frontend/dist
-RUN cargo build --locked --release --target-dir target && cp ./target/release/prodzilla /bin/prodzilla
+RUN --mount=type=cache,target=/usr/local/cargo/registry,sharing=locked \
+    --mount=type=cache,target=/usr/local/cargo/git,sharing=locked \
+    cargo build --locked --release --bin prodzilla \
+    && cp ./target/release/prodzilla /bin/prodzilla
 
 FROM debian:bookworm-slim AS final
 
diff --git a/scripts/preview-entrypoint.sh b/scripts/preview-entrypoint.sh
index 4b3667c..1bf9b3e 100755
--- a/scripts/preview-entrypoint.sh
+++ b/scripts/preview-entrypoint.sh
@@ -5,14 +5,14 @@ SOCK=/tmp/tailscaled.sock
 
 tailscaled \
     --tun=userspace-networking \
-    --state=mem: \
+    --state=/tmp/tailscale-state \
     --socket="$SOCK" &
 
 i=0
-until tailscale --socket="$SOCK" status >/dev/null 2>&1; do
+until [ -S "$SOCK" ]; do
     i=$((i + 1))
     if [ $i -gt 50 ]; then
-        echo "tailscaled did not become ready within 10s" >&2
+        echo "tailscaled socket did not appear within 10s" >&2
         exit 1
     fi
     sleep 0.2